Re: [dnsext] DNSSEC, robustness, and several DS records

In message <201105112022.p4BKMHmp010275@givry.fdupont.fr>, Francis Dupont writes:
>  In your previous mail you wrote:
> 
>    Note that the text in RFC 4509 has a SHOULD, not a MUST. The fact
>    that the BIND and Unbound people treat it as a MUST seems like a
>    bug.
>    
> => I don't understand how the SHOULD can be interpreted in order to
> avoid the "bug" (:-). Seriously you can disagree with RFC 4509
> but not about the way it has to be implemented, i.e., your concern
> is not about what it should be...
> 
> Regards
> 
> Francis.Dupont@fdupont.fr
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext

Agreed.  You are either configured to follow the SHOULD or not and
the default is to fail.  Now not having a switch to turn it off
means you don't have a work around once you discover that DS is
wrong which requires contacting the administrators for the zone as
they are the only ones that can tell you whether it is wrong or you
are under attack.  You can make a educated guess without contacting
the zone administrators.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org